starmath/source/mathmlattr.cxx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
New commits: commit cd5a4971bb84bb588a990a252a84ed799fe1ebeb Author: Caolán McNamara <[email protected]> Date: Sun Dec 10 11:50:09 2017 +0000 ofz#4578 Integer-overflow Change-Id: I2fcd530b3217c72385301b8f3456557c8c8cec13 Reviewed-on: https://gerrit.libreoffice.org/46183 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> diff --git a/starmath/source/mathmlattr.cxx b/starmath/source/mathmlattr.cxx index f68bc003e4ff..2b0c70335430 100644 --- a/starmath/source/mathmlattr.cxx +++ b/starmath/source/mathmlattr.cxx @@ -62,8 +62,12 @@ sal_Int32 ParseMathMLUnsignedNumber(const OUString &rStr, Fraction *pUN) assert(nDecimalPoint < nIdx); *pUN = Fraction(rStr.copy(0, nDecimalPoint).toInt32(), 1); if (++nDecimalPoint < nIdx) - *pUN += Fraction(rStr.copy(nDecimalPoint, nIdx-nDecimalPoint).toInt32(), - lcl_GetPowerOf10(nIdx-nDecimalPoint)); + { + const sal_Int32 nDigits = nIdx - nDecimalPoint; + if (nDigits > 9) + return -1; + *pUN += Fraction(rStr.copy(nDecimalPoint, nDigits).toInt32(), lcl_GetPowerOf10(nDigits)); + } return nIdx; }
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
